973c89410b3e52c62fce409a5a173018_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

973c89410b3e52c62fce409a5a173018_JaffaCakes118
Size

136KB
MD5

973c89410b3e52c62fce409a5a173018
SHA1

279ef26c3fc9edf93de78f31d9ad6ae03b679476
SHA256

46bf507aec2d7969a63427f8b5b1157d55ce0c98050be913d8e26c6195a32526
SHA512

8983bfa5743a40888a7b625c7b88a79034223c427d47fc5ce279244deb924c73b141fa117224ad554d6f64f6cd8b764979f77c4dcd8bec907196827c80fe5578
SSDEEP

3072:s0eKWNUdD4FbZ4oorIK14cWQjsUn49sDZR4U9wVukFBpXM:s0eKcUdD4p4kQnr598ukXpXM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
973c89410b3e52c62fce409a5a173018_JaffaCakes118

Files

973c89410b3e52c62fce409a5a173018_JaffaCakes118
.dll windows:3 windows x86 arch:x86

cef1a5f8123069d522b70b7cc370371f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegEnumKeyExA
RegEnumValueA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
GetUserNameA

kernel32

CloseHandle
CreateEventA
CreateFileA
CreateFileMappingA
CreateMutexA
CreateProcessA
CreateThread
DeleteFileA
ExitThread
FreeLibrary
GetCurrentProcessId
GetCurrentThreadId
GetFileSize
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetSystemDirectoryA
GetSystemTime
GetTempPathA
GetTickCount
GetVersion
GetVolumeInformationA
GlobalLock
GlobalUnlock
IsBadReadPtr
LoadLibraryA
MapViewOfFile
OpenEventA
ReadFile
ReleaseMutex
ResetEvent
ResumeThread
SetEndOfFile
SetErrorMode
SetEvent
SetFileAttributesA
SetFilePointer
Sleep
SystemTimeToFileTime
UnmapViewOfFile
WaitForMultipleObjects
WaitForSingleObject
WriteFile
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
GetEnvironmentVariableA
GetLocalTime
GetLocaleInfoA
GetTimeZoneInformation
GetWindowsDirectoryA
FileTimeToSystemTime
FindClose
FindFirstFileA
FindNextFileA
GetCurrentProcess
GetDiskFreeSpaceA
GetDriveTypeA
GetFileTime
GetLogicalDrives
SetFileTime
CreatePipe
DuplicateHandle
GetExitCodeProcess
PeekNamedPipe
TerminateProcess
TerminateThread
FormatMessageA
GetFileType
GetPrivateProfileSectionA
MoveFileA
VirtualAlloc
VirtualFree
WritePrivateProfileSectionA

wsock32

getsockname
shutdown
send
recv
listen
inet_ntoa
connect
bind
WSAAsyncSelect
gethostname
inet_addr
ioctlsocket
closesocket
accept
WSAStartup
WSAGetLastError
WSACleanup
WSACancelAsyncRequest
WSAAsyncGetHostByName
WSAAsyncGetHostByAddr
socket

user32

OemToCharBuffA
CharToOemBuffA
ExitWindowsEx
UnregisterClassA
UnhookWindowsHookEx
TranslateMessage
ShowWindow
SetWindowsHookExA
SendMessageA
RegisterClassA
PostThreadMessageA
PostMessageA
PeekMessageA
OpenClipboard
MsgWaitForMultipleObjects
MessageBoxA
IsClipboardFormatAvailable
GetWindowThreadProcessId
GetWindowTextA
CallNextHookEx
CloseClipboard
CreateWindowExA
DefWindowProcA
DestroyWindow
DispatchMessageA
EnumWindows
FindWindowA
GetActiveWindow
GetClassNameA
GetClipboardData
GetMessageTime
GetParent

shell32

ShellExecuteA

Exports

Exports

DebugBreakpoint
DebugInit
Init
InitService
SpawnedInit
Uninstall

Sections

.text
Size: 94KB - Virtual size: 94KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 4B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

shared
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cef1a5f8123069d522b70b7cc370371f

Headers

File Characteristics

Imports

advapi32

kernel32

wsock32

user32

shell32

Exports

Exports

Sections

.text Size: 94KB - Virtual size: 94KB

.bss Size: - Virtual size: 4B

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 17KB - Virtual size: 16KB

.idata Size: 3KB - Virtual size: 3KB

shared Size: 4KB - Virtual size: 3KB

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: 94KB - Virtual size: 94KB

.bss
Size: - Virtual size: 4B

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 17KB - Virtual size: 16KB

.idata
Size: 3KB - Virtual size: 3KB

shared
Size: 4KB - Virtual size: 3KB

.reloc
Size: 5KB - Virtual size: 5KB